Claude Skills Security Checklist

1. Read the instructions

The first risk is not code; it is instruction. A malicious or careless skill can tell the agent to collect secrets, ignore user intent, use private data in examples, or make unsupported claims. Read SKILL.md like you would read a policy file that the agent may follow during work.

Look for hidden scope expansion. A skill for formatting slides should not ask the agent to inspect unrelated directories. A skill for customer support should not tell the agent to paste full transcripts into external services unless that is explicitly approved.

2. Review scripts as code

Scripts are useful precisely because they can do real work. That means they require real review. Check file reads and writes, network calls, shell invocation, dependency installation, environment-variable access, and cleanup behavior.

Prefer scripts that are deterministic, narrow, and easy to run on fixtures. Be wary of scripts that install packages at runtime, execute remote code, or operate on broad paths without confirmation.

3. Inspect references and assets

References can leak private policy or customer examples. Assets can carry macros, embedded files, or outdated templates. Before sharing a skill outside a trusted boundary, inspect everything in the folder, not only the entrypoint.

For organization skills, separate public guidance from confidential details. A public skill can tell an agent to follow a review process without including the entire internal policy manual.

4. Verify distribution source

Install from sources you can audit. If a skill arrives through a plugin or repository, check the publisher, recent changes, license, and issue history. Pin or vendor critical skills when reproducibility matters.

Do not confuse popularity with safety. A popular skill can still be too broad, stale, or risky for your data environment.

5. Define runtime boundaries

A skill should say when to ask the user before running destructive commands, making network calls, modifying production systems, or handling regulated data. The agent environment should also enforce the boundaries through permissions, sandboxing, and review gates.

Skill text is not a substitute for security controls. Treat it as one layer in a broader operating model.

FAQ